Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
1. Interview the IAM or site representative and obtain the list of accounts that have been delegated AD object ownership or update permissions and that are not members of Windows built-in administrative groups. (This includes accounts for help desk or support personnel who are not Administrators, but have authority in AD to maintain user accounts or printers.) 2. If accounts with delegated authority are defined and there is no list, then this is a finding. 3. Count the number of accounts on the list. 4. If the number of accounts with delegated authority is greater than 10, review the site documentation that justifies this number. Validate that the IAM explicitly acknowledges the need to have a high number of privileged users. 5. If the number of accounts with delegated authority is greater than 10 and there is no statement in the documentation that justifies the number, then this is a finding.
1. Remove user accounts with delegated authority from Windows built-in administrative groups or remove the delegated authority from the accounts. 2. Document all user accounts with delegated AD object ownership or update authority. 3. Annotate the account list with a statement such as, “The high number of privileged accounts is required to address site operational requirements.” 4. Reduce the number of user accounts with delegated AD object ownership or update authority.
1. Review the site's network diagram(s) to determine if domain controllers for the domain are located in multiple enclaves. The object is to determine if network traffic is traversing enclave network boundaries. 2. Request information about RODC or ADAM instances are installed. In particular, request details of Active Diretory functionality installed or extended into the DMZ or configured/allowed to cross the sites outbound firewall boundary. Ensure communications and replication traffic is encrypted. 3. If domain controllers are not located in multiple enclaves, then this check is not applicable. 4. If domain controllers are located in multiple enclaves, verify that a VPN is used to transport the network traffic (replication, user logon, queries, etc.). 5. If a VPN solution is not used to transport directory network traffic across enclave boundaries, then this is a finding. 6. If the ADAM mode is in use and a migration plan for converting to RODC is not in place, then this is a finding.
Implement a VPN or other network protection solution in accordance with the Network Infrastructure STIG that protects AD data in transit across DoD enclave boundaries.
1. Interview the site representative. Ask about the location of the domain controllers. 2. If domain controllers are not located in multiple enclaves, then this check is not applicable. 3. If domain controllers are located in multiple enclaves and a VPN is not used, then this check is not applicable. 4. If domain controllers are located in multiple enclaves and a VPN is used, review the site network diagram(s) with the SA, NSO, or network reviewer as required to determine if the AD network traffic is visible to a network or host IDS. 5. If the AD network traffic is not visible to a network or host IDS, then this is a finding.
Replace the VPN solution or reconfigure it so that directory data is inspected by a network or host-based IDS.
1. Determine the MAC level information for the directory server. If the asset is registered in VMS, this is available by using Asset Finding Maint. and navigating to the asset or by running an Asset Information (AS01) report for the location. 2. If the MAC level of the directory server is III, this check is not applicable. 3. Start the Active Directory Users and Computers console (Start, Run, “dsa.msc”). 4. Select and expand the left pane item that matches the name of the domain being reviewed. 5. Select the Domain Controllers [OU] item in the left pane. 6. Count the number of computers (objects) in the Domain Controllers OU. 7. If there is only one domain controller for a MAC I or II level domain, then this is a finding.
When the domain supports a MAC I or II domain, the directory service will be supported by multiple directory servers.
1. Interview the IAO. Ask about the MAC levels of the system. 2. Determine the MAC level information for the AD Domain asset. If the asset is registered in VMS, this is available by using Asset Finding Maint. and navigating to the asset or by running an Asset Information (AS01) report for the location. 3. If the MAC level of the AD Domain is III, this check is not applicable. 4. Obtain a copy of the site’s disaster recovery planning documents. 5. Check the disaster recovery plans for documentation on the AD hierarchy (forest, tree, and domain structure). (A chart showing forest hierarchy and domain names is the minimum suggested.) 6. If the disaster recovery plans that cover a MAC I or II level AD Domain do not include directory hierarchy information, then this is a finding.
Update the disaster recovery plans to include directory service architecture details such as hierarchy and replication structure.
1. Refer to the list of actual manual AD trusts (cross-directory configurations) collected from the site representative. 2. If there are no manual AD trusts (cross-directory configurations) defined, this check is not applicable. For AD, this includes external, forest, or realm trust relationship types. 3. Obtain a copy of the site’s supplemental INFOCON procedures as required by Strategic Command Directive (SD) 527-1. 4. Verify that it has been determined by the IAM whether INFOCON response actions need to include procedures to disable manual AD trusts (cross-directory configurations). The objective is to determine if the need has been explicitly evaluated. 5. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) are not necessary, then this check is not applicable. 6. If it has been determined that actions to disable manual AD trusts (cross-directory configurations) *are* necessary, verify that the policy to implement these actions has been documented. 7. If actions to disable manual AD trusts (cross-directory configurations) *are* needed and no policy has been documented, then this is a finding.
Evaluate cross-directory configurations (such as trusts and pass-through authentication) and provide documentation that indicates: 1. That an evaluation was performed. 2. The specific AD trust configurations, if any, that should be disabled during changes in INFOCON status because they could represent increased risk.
1. Start the Active Directory Domains and Trusts console (Start, Run, “domain.msc”). 2. Select the left pane item that matches the name of the domain being reviewed. 3. Right-click the domain name and select the Properties item. 4. On the domain object Properties window, select the Trusts tab. 5. For each outbound and inbound external, forest, and realm trust, record the name of the other party (domain name), the trust type, transitivity, and the trust direction. (Keep this trust information for use in subsequent checks.) 6. Compare the list of actual trusts identified with the list in local documentation maintained by the IAO. For each trust, the documentation must contain type (external, forest, or realm), name of the other party, MAC and classification level of the other party, trust direction (inbound and\or outbound), transitivity, status of the Selective Authentication option, and status of the SID filtering option. 7. If an identified trust is not listed in the documentation or if any of the required items are not documented, then this is a finding.
Develop documentation for each AD external, forest, and realm trust configuration. At a minimum this must include: a. Type (external, forest, or realm). b. Name of the other party. c. MAC, confidentiality, and classification level of the other party. d. Trust direction (inbound and\or outbound). e. Transitivity. f. Status of the Selective Authentication option. g. Status of the SID filtering option.
1. Before performing this check, perform V-8530 which validates the trusts within the documentation are current within AD. 2. Obtain documentation of the site's approved trusts from the site representative. 3. For each of the identified trusts, verify that the documentation includes a justification or explanation of the need-to-know basis of the trust. 4. If the need for the trust is not documented, then this is a finding.
Delete the unneeded trust relationship or document the access requirement or mission need for the trust.
1. Refer to the list of identified trusts and the trust documentation provided by the site representative. (Obtained in V-8530) 2. For each of the identified trusts between DoD organizations, compare the classification level (unclassified, confidential, secret, and top secret) of the domain being reviewed with the classification level of the other trust party as noted in the documentation. 3. If the classification level of the domain being reviewed is different than the classification level of any of the entities for which a trust relationship is defined, then this is a finding.
Delete the trust relationship that is defined between entities with resources at different DoD classification levels.
1. Refer to the list of identified trusts obtained in a previous check (V8530). 2. For each of the identified trusts, determine if the other trust party is a non-DoD entity. For example, if the fully qualified domain name of the other party does not end in “.mil”, the other party is probably not a DoD entity. 3. Review the local documentation approving the external network connection and documentation indicating explicit approval of the trust by the DAA. 4. The external network connection documentation is maintained by the IAO\NSO for compliance with the Network Infrastructure STIG. 5. If any trust is defined with a non-DoD system and there is no documentation indicating approval of the external network connection and explicit DAA approval of the trust, then this is a finding.
Obtain DAA approval and document external, forest, or realm trust relationship. Or obtain documentation of the network connection approval and explicit trust approval by the DAA.
Open "Active Directory Domains and Trusts". (Available from various menus or run "domain.msc".) Right click the domain in the left pane and select Properties. Select the Trusts tab. Note any existing trusts and the type. If no trusts exist, this is NA. If the trust type is External, run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /quarantine" If the result does not specify "SID filtering is enabled for this trust. Only SIDs from the trusted domain will be accepted for authorization data returned during authentication. SIDs from other domains will be removed.", this is a finding. If the trust type is Forest, run the following command on the trusting domain: "netdom trust <trusting domain> /d:<trusted domain> /enablesidhistory" If the result does not specify "SID history is disabled for this trust", this is a finding.
Ensure SID filtering is enabled on all external trusts. You can enable SID filtering only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /quarantine:Yes /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd> Ensure SID history is disabled for all forest trusts. You can disable SID history only from the trusting side of the trust. Enter the following line from a command line: netdom trust <TrustingDomainName> /d:<TrustedDomainName> /enablesidhistory:No /usero:<DomainAdministratorAcct> /passwordo:<DomainAdminPwd>
1. Start the Active Directory Domains and Trusts console (Start, Run, “domain.msc”). 2. Select the left pane item that matches the name of the domain being reviewed and perform the following: a. Right-click the domain name and select the Properties item. b. On the domain object Properties window, select the Trusts tab. c. For each outgoing forest trust, right-click the trust item and select the Properties item. d. On the trust Properties window, select the Authentication tab. Determine if the Selective Authentication option is selected. 3. If the Selective Authentication option is not selected on every outgoing forest trust, then this is a finding.
Enable Selective Authentication on the outgoing forest trust.
1. Start the Active Directory Users and Computers console (Start, Run, “dsa.msc”). 2. Select and expand the left pane item that matches the name of the domain being reviewed and perform the following: a. Select the Builtin item. b. Double-click the Pre-Windows 2000 Compatible Access group and select the Members tab. 3. If the Anonymous Logon group or Everyone group is a member of the Pre-Windows 2000 Compatible Access group, then this is a finding.
Remove the Everyone and Anonymous Logon groups from the Pre-Windows 2000 Compatible Access group.
1. Start the Active Directory Users and Computers console (Start, Run, “dsa.msc”). 2. Select and expand the left pane item that matches the name of the domain being reviewed. 3. Select the Built-in container. If the Incoming Forest Trust Builders group is defined perform the following: a. Double-click on the group and select the Members tab b. Count the number of accounts in the group c. Compare the accounts in the group with the local documentation. 4. Select the Users container. For each of the Domain Admins, Enterprise Admins, Schema Admins, and Group Policy Creator Owners groups perform the following: a. Double-click on the group and select the Members tab b. Count the number of accounts in the group c. Compare the accounts in the group with the local documentation. 5. If an account in a highly privileged AD security group is not listed in the local documentation, then this is a finding. 6. If the number of accounts defined in a highly privileged AD security group is greater than the number below, review the site documentation that justifies this number. a. For the Enterprise Admins, Schema Admins, Group Policy Creator Owners, and Incoming Forest Trust Builders groups, the number of accounts should be between zero (0) and five (5). b. The number of Domain Admins should be between one (1) and ten (10). 7. If the number of accounts defined in a highly privileged AD security group is greater than the guidance above and there is no documentation that justifies the number, then this is a finding.
Update the site documentation to include all the accounts that are members of highly privileged groups. Annotate the account list(s) with a statement such as, “The high number of privileged accounts is required to address site operational requirements.” Reduce the number of accounts in highly privileged groups to the minimum level necessary.
1. Start the Active Directory Users and Computers console (Start, Run, “dsa.msc”). 2. Select and expand the left pane item that matches the name of the domain being reviewed. 3. Select the Built-in container. a. If the Incoming Forest Trust Builders group is defined, double-click on the group, and select the Members tab b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed. 4. Select the Users container a. For each group (Domain Admins, Enterprise Admins, Schema Admins, and Group Policy Creator Owners), double-click on the group, and select the Members tab. b. Examine the defined accounts to see if they are from a domain that is not in the forest being reviewed. 5. If any account in a privileged group is from a domain outside the forest being reviewed and that outside forest is not maintained by the same organization (e.g., enclave) or subject to the same security policies, then this is a finding. Supplementary Notes: Note: An account that is from an outside domain appears in the format “outside-domain-NetBIOSname\account” or “account@outside-domain-fully-qualified-name”. Examples are “AOFN21\jsmith” or “jsmith@AOFN21.OST.COM”. It may be necessary to use the AD Domains and Trusts (domain.msc) console to determine if the domain is from another AD forest. Note: It is possible to move the highly privileged AD security groups out of the AD Users container. If the Domain Admins, Enterprise Admins, Schema Admins, or Group Policy Creator Owners groups are not in the AD Users container, ask the SA for the new location and use that location for this check.
Remove accounts from outside directories that are not part of the same organization or are not subject to the same security policies from the highly privileged groups.
Open "Active Directory Domains and Trusts" (run "domain.msc") or "Active Directory Users and Computers" (run "dsa.msc"). Right click in the left pane on the name of the Domain being reviewed. Select "Raise domain functional level…" The current domain functional level will be displayed (as well as the option to raise the domain functional level). Select "Cancel" to exit. Alternately, using PowerShell (Windows 2008 R2 or later). Select "Active Directory Module for Windows PowerShell", available in Administrative Tools or the Start Screen. Run "Get-ADDomain". View the value for "DomainMode:" If the current domain functional level is a Windows Server version no longer supported by Microsoft, this is a finding. Microsoft will no longer support Windows Server 2003 after 14 July 2015.
Raise the domain functional level to a Windows Server version still supported by Microsoft. Microsoft will no longer support Windows Server 2003 after 14 July 2015. Raising the domain functional level needs to be carefully planned and implemented. This prevents the addition of domain controllers to the domain using Windows versions prior to the current domain functional level. See Microsoft documentation for the process and requirements of raising the domain functional level.
1. Start the Active Directory Sites and Services console (Start, Run, “dssite.msc”). 2. Select and expand the Sites item in the left pane. 3. Select and expand the Inter-Site Transports item and the IP item in the left pane. 4. For each site link that is defined perform the following: a. Right-click the site link item and select the Properties item. b. Note the interval indicated in the “Replicate every” field. c. Click the Change Schedule button. d. Using the values indicated for “Replication Available”, determine if the replication interval would allow daily replication to occur. e. Click the Cancel button for the Schedule window. f. Click the Cancel button for the Properties window. g. If the replication interval and replication available properties do not allow daily replication, then this is a finding.
Enable daily replication (at a minimum) for the directory service.
1. Interview the IAO. 2. Obtain a copy of the site’s SOP for backups. 3. Check the SOP for the frequency at which directory data is backed up. Alternatively, physically verify that backups are being performed. 4. If the directory data for a MAC III system is not backed up at least weekly, then this is a finding. 5. If the directory data for a MAC I or II system is not backed up at least daily, then this is a finding.
1. Change local site procedures to include a complete backup of directory data in compliance with the following frequency: a. MAC I or II system - back up the directory data at least daily. b. MAC III systems - back up the directory data at least weekly. 2. Change local site procedures to use a backup tool that is appropriate for the directory technology. 3. Ensure that the type of backup is appropriate to capturing the directory data. For AD domain controllers, this must include a System State data backup
1. Interview the IAM. 2. Obtain a copy of the site’s policy that addresses password change frequency. 3. Check that the policy addresses the requirement for the DSRM password to be changed at least yearly. Alternatively review logs or other evidence that indicates that the password has been changed within the last year. Note that there is no known method to check password age online while the server is active as a domain controller. 4. If there is no policy for changing the DSRM password at least yearly or no indication that it has been changed within the last year, then this is a finding.
Create or implement a local site policy to change the DSRM password at least yearly.
1. Verify that the domain and forest in which the domain controller resides have been reviewed using the requirements in the appropriate document in the Active Directory STIG. 2. The security assessment must be conducted at the same time or no more than 1 year prior to the review of the domain controller. 3. VMS asset information, dated reports, or other documentation can be used to provide verification. 4. If it is not possible to verify that the domain and forest have been reviewed, then this is a finding.
Perform reviews of the domain and/or forest in which the domain controller resides at least annually.
1. Verify that the site has applied the Network Infrastucture STIG to configure the VPN and IPSec. 2. Verify that IPSec and other communications and security configurations for the management and replication of the RODC will be managed by use of the minimum required Group Policy Objects (GPOs). 3. Include an inspection of the RODC server in the DMZ when inspection for least privilege. 4. Verify that required patches and compatibility packs are installed if RODC is used with Windows 2003 (or earlier) clients. 5. If RODC server and configuration does not comply with requirements, then this is a finding.
1. Ensure compliance with VPN and IPSec requirements in the Network Insfrastucture STIG. 2. Ensure IPSec and other communications and security configurations for the management and replication of the RODC uses the minimum required Group Policy Objects (GPOs) to provide the required functionality. 3. Replicate only the information needed to provide the functionality required. If full replication of all directory data is not needed, then replicated selective ID and authentication information as needed to the RODC. 4. Include an inspection of the RODC server in the DMZ when inspection for least privilege.
Review the Enterprise Admins group in Active Directory Users and Computers. Any accounts that are members of the Enterprise Admins group must be documented with the IAO. Each Enterprise Administrator must have a separate unique account specifically for managing the Active Directory forest. If any account listed in the Enterprise Admins group is a member of other administrator groups including the Domain Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding.
Create the necessary documentation that identifies the members of the Enterprise Admins group. Ensure that each member has a separate unique account that can only be used to manage the Active Directory Forest. Remove any Enterprise Admin accounts from other administrator groups.
Review the Domain Admins group in Active Directory Users and Computers. Any accounts that are members of the Domain Admins group must be documented with the IAO. Each Domain Administrator must have a separate unique account specifically for managing the Active Directory domain and domain controllers. If any account listed in the Domain Admins group is a member of other administrator groups including the Enterprise Admins group, domain member server administrators groups, or domain workstation administrators groups, this is a finding.
Create the necessary documentation that identifies the members of the Domain Admins group. Ensure that each member has a separate unique account that can only be used to manage the Active Directory domain and domain controllers. Remove any Domain Admin accounts from other administrator groups.
Review the membership groups in Active Directory Users and Computers. Membership groups must be designated at the domain level specifically for domain member server administrators. Domain member server administrator groups and any accounts that are members of the groups must be documented with the IAO. Each member server administrator must have a separate unique account specifically for managing member servers. If any account listed in a domain member server administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain workstation administrator groups, this is a finding.
Create the necessary documentation that identifies the members of domain member server administrator groups. Ensure that each member has a separate unique account that can only be used to manage domain member servers. Remove any domain member server accounts from other administrator groups.
Review the membership groups in Active Directory Users and Computers. Membership groups must be designated at the domain level specifically for domain workstation administrators. Domain workstation administrator groups and any accounts that are members of the groups must be documented with the IAO. Each domain workstation administrator must have a separate unique account specifically for managing domain workstations. If any account listed in a domain workstation administrator group is a member of other administrator groups including the Enterprise Admins group, the Domain Admins group, or domain member server administrator groups, this is a finding.
Create the necessary documentation that identifies the members of domain workstation administrator groups. Ensure that each member has a separate unique account that can only be used to manage domain workstations. Remove any domain workstation administrator accounts from other administrator groups.
Review the properties of all privileged accounts in Active Directory Users and Computers. Under the Account tab, verify "Account is sensitive and cannot be delegated" is selected in the Account Options section. If delegation is not prohibited for any privileged account, this is a finding.
Open Active Directory Users and Computers. View the properties of all privileged accounts. Under the Account tab, select "Account is sensitive and cannot be delegated" in the Account Options section.
If Active Directory is only managed with local logons to domain controllers, not remotely, this can be marked NA. Verify that any domain systems used to manage Active Directory remotely are used exclusively for managing Active Directory. If domain systems used for managing Active Directory are used for additional functions, this is a finding. In situations where an additional physical machine dedicated to AD admin tasks is not practicable, virtual machines (VM) may be securely employed in either of the following configurations: -Windows 8, Windows Server 2012 or later for the AD admin management role. -Use local guest VMs running within Hyper-V for all other tasks to include admin roles on other servers as well as any user tasks such as web browsing or email. -Use a Type-1 Hypervisor with separate guest VMs for AD admin management roles and any other roles. In either case, the higher integrity AD admin platform and the lower integrity platforms must be separate. The AD admin platform must be configured not to forward the AD admin credentials to other guest VMs or to make the AD admin credentials available to other guest VMs. Additionally, guest VMs for user and less critical admin activities must apply the security requirements from the applicable STIG, especially so that AD admin accounts are denied all logon types.
Set aside domain systems to manage Active Directory remotely. Ensure they are used only for the purpose of managing Active Directory. Otherwise, use the local domain controller console to manage Active Directory.
Verify access to the internet is prevented for systems dedicated to managing Active Directory. Various methods may be employed to accomplish this, such as restrictions at boundary firewalls, through proxy services, or with the Windows Firewall. Review the Internet access restrictions with the administrator. If Internet access is not prevented, this is a finding.
Block Internet access for systems dedicated to managing Active Directory. This can be accomplished by restrictions at boundary firewalls, proxy services, with the Windows Firewall or other methods.
Verify local administrator accounts on domain systems are using unique passwords. If local administrator accounts on domain systems are sharing a password, this is a finding.
Set unique passwords for all local administrator accounts on domain systems.
Verify separate smart cards are used for EA and DA accounts from smart cards used for other accounts. EA and DA accounts may be on the same smart card but must be separate from any other accounts. If separate smart cards for EA and DA accounts from other accounts are not used, this is a finding.
Use separate smart cards for EA and DA accounts from smart cards used for other accounts. EA and DA accounts may be on the same smart card but must be separate from any other accounts.
Verify "Smart card is required for interactive logon" is disabled and re-enabled for all smart card required EA and DA accounts at least every 60 days. If the setting "Smart card is required for interactive logon" is not disabled then re-enabled for all EA and DA accounts that require smart card logons at least every 60 days, this is a finding.
Disable then re-enable "Smart card is required for interactive logon" for all smart card required EA and DA accounts at least every 60 days.
Verify "Smart card is required for interactive logon" is disabled and re-enabled for all smart card required administrative accounts associated with critical servers at least every 60 days. If the setting "Smart card is required for interactive logon" is not disabled then re-enabled for all critical server administrative accounts that require smart card logons at least every 60 days, this is a finding.
Disable then re-enable "Smart card is required for interactive logon" for all smart card required critical server administrative accounts at least every 60 days.
Verify "Smart card is required for interactive logon" is disabled and re-enabled for all smart card required other important accounts (VIPS and other administrators) at least every 60 days. If the setting "Smart card is required for interactive logon" is not disabled then re-enabled for other important accounts (VIPS and other administrators) that require smart card logons at least every 60 days, this is a finding.
Disable then re-enable "Smart card is required for interactive logon" for all smart card required other important accounts (VIPS and other administrators) at least every 60 days.
If the domain does not have any public facing servers, this is NA. Review the local Administrators group on public facing servers. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For public facing servers, the Domain Admins group must be replaced by a domain member server administrator group whose members are different from any used to manage internal servers. If any domain accounts or groups used to manage internal servers are members of the local administrators group, this is a finding.
If the domain does not have any public facing servers, this is NA. Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For public facing servers, replace the Domain Admins group with a domain member server administrator group whose members are different from any used to manage internal servers.
Verify the operating system version on AD admin platforms is at least Windows 7, Windows Server 2008 R2, or later. If the operating system is an earlier version, this is a finding.
Use Windows 7, Windows Server 2008 R2, or later as the operating system for all AD admin platforms.
Review the local Administrators group of AD admin platforms. Verify separate domain administrative accounts are used to manage AD admin platforms from non-AD admin platforms. These should be dedicated domain accounts where practicable. Otherwise EA/DA accounts may be used. If accounts used to manage AD admin platforms are used for any non-AD admin platforms, this is a finding.
Use separate domain administrative accounts to manage AD admin platforms from non-AD admin platforms. These should be dedicated domain accounts where practicable. Otherwise EA/DA accounts may be used.
Verify account usage events for administrative accounts are being monitored. This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below, at minimum. If these events are not monitored, this is a finding. Windows Vista and later: Account Lockouts (Subcategory: User Account Management) 4740 - A user account is locked out. User Added to Privileged Group (Subcategory: Security Group Management) 4728 - A member was added to a security-enabled global group. 4732 - A member was added to a security-enabled local group. 4756 - A member was added to a security-enabled universal group. Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Account Login with Explicit Credentials (Subcategory: Logon) 4648 - A logon was attempted using explicit credentials. Windows 2003: Account Lockouts (Account Management Events) 644 - A user account was automatically locked. Failed Login (Logon Events) 529 - Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. Successful Login (Logon Events) 528 - A user successfully logged on to a computer. User Initiated Logoff (Logon Events) 551 - A user initiated the logoff process. Account Login with Explicit Credentials (Logon Events) 552 - A user successfully logged on to a computer with explicit credentials while already logged on as a different user. Successful Network Login (Logon Events) 540 - A user successfully logged on to a network. User Account Created (Account Management Events) 624 - A user account was created. Change Password Attempt (Account Management Events) 627 - A user password was changed. User Added to Privileged Group (Account Management Events) 632 - A member was added to a global group. 636 - A member was added to a local group. 660 - A member was added to a security-enabled universal group.
Monitor account usage events for administrative accounts. This includes events related to approved administrative accounts as well as accounts being added to privileged groups such as Administrators, Domain and Enterprise Admins and other organization defined administrative groups. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below, at minimum. Windows Vista and later: Account Lockouts (Subcategory: User Account Management) 4740 - A user account is locked out. User Added to Privileged Group (Subcategory: Security Group Management) 4728 - A member was added to a security-enabled global group. 4732 - A member was added to a security-enabled local group. 4756 - A member was added to a security-enabled universal group. Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Account Login with Explicit Credentials (Subcategory: Logon) 4648 - A logon was attempted using explicit credentials. Windows 2003: Account Lockouts (Account Management Events) 644 - A user account was automatically locked. Failed Login (Logon Events) 529 - Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. Successful Login (Logon Events) 528 - A user successfully logged on to a computer. User Initiated Logoff (Logon Events) 551 - A user initiated the logoff process. Account Login with Explicit Credentials (Logon Events) 552 - A user successfully logged on to a computer with explicit credentials while already logged on as a different user. Successful Network Login (Logon Events) 540 - A user successfully logged on to a network. User Account Created (Account Management Events) 624 - A user account was created. Change Password Attempt (Account Management Events) 627 - A user password was changed. User Added to Privileged Group (Account Management Events) 632 - A member was added to a global group. 636 - A member was added to a local group. 660 - A member was added to a security-enabled universal group. The "Account Usage" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides additional information. http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf.
Verify attempts to use local accounts to log on remotely from other systems are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Windows Vista and later: Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Windows 2003: Successful Network Login (Logon Events) 540 - A user successfully logged on to a network. Failed Login (Logon Events) 529 - Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password.
Monitor for attempts to use local accounts to log on remotely from other systems. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 3 (Network) Authentication Package Name = NTLM Not a domain logon and not the ANONYMOUS LOGON account Windows Vista and later: Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Failed User Account Login (Subcategory: Logon) 4625 - An account failed to log on. Windows 2003: Successful Network Login (Logon Events) 540 - A user successfully logged on to a network. Failed Login (Logon Events) 529 - Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. The "Pass the Hash Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf.
Verify Remote Desktop logins are being monitored. Event monitoring may be implemented through various methods including log aggregation and the use of monitoring tools. Monitor for the events listed below. If these events are not monitored, this is a finding. More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Windows Vista and later: Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Windows 2003: Successful Login (Logon Events) 528 - A user successfully logged on to a computer.
More advanced filtering is necessary to obtain the pertinent information than just looking for event IDs. Search for the event IDs listed with the following additional attributes: Logon Type = 10 (RemoteInteractive) Authentication Package Name = Negotiate Windows Vista and later: Successful User Account Login (Subcategory: Logon) 4624 - An account was successfully logged on. Windows 2003: Successful Login (Logon Events) 528 - A user successfully logged on to a computer. The "Remote Desktop Logon Detection" section of NSA's "Spotting the Adversary with Windows Event Log Monitoring" provides a sample query for filtering. http://www.nsa.gov/ia/_files/app/Spotting_the_Adversary_with_Windows_Event_Log_Monitoring.pdf.
Verify firewall rules prevent outbound communications from AD admin platforms, except for domain controllers being managed. If outbound communications are allowed between AD admin platforms and any other systems other than domain controllers, this is a finding.
Maintain firewall rules to prevent outbound communications from AD admin platforms, except with domain controllers being managed.
If no Windows service \ application accounts with manually managed passwords have administrative privileges, this is NA. Verify Windows service \ application accounts with administrative privileges and manually managed passwords, have passwords changed at least every 60 days.
If no Windows service \ application accounts with manually managed passwords have administrative privileges, this is NA. Change passwords for Windows service \ application accounts with administrative privileges and manually managed passwords, at least every 60 days.
Verify domain controllers are blocked from Internet access. Various methods may be employed to accomplish this, such as restrictions at boundary firewalls, through proxy services, host based firewalls or IPsec. Review the Internet access restrictions with the administrator. If Internet access is not prevented, this is a finding. If a critical function requires Internet access, this must be documented and approved by the organization.
Block domain controllers from internet access. This can be accomplished with various methods, such as restrictions at boundary firewalls, proxy services, host based firewalls, or IPsec. If a critical function requires Internet access, this must be documented and approved by the organization.